Setting up Frill SSO

This guide covers the general setup process for team SSO in Frill. For provider-specific instructions, see the Okta or Microsoft Entra ID configuration articles.

Before you begin

Gather these details from your identity provider:

• For SAML (Okta): IdP SSO URL, IdP Issuer, and x509 Certificate

• For OIDC (Microsoft Entra ID): Client ID, Client Secret, and Tenant ID

• For token-based: Your SSO Secret Key from Frill settings

Enable SSO in Frill

1. Go to Settings → Company → SSO

2. Select your identity provider (Okta, Microsoft Entra ID, or Frill token-based)

3. Enter the required configuration details from your IdP

4. Click Save to enable SSO

Configure your identity provider

In your identity provider's admin panel, create a new SAML or OIDC application. You'll need these values from Frill:

• ACS URL (SAML) or Redirect URI (OIDC): Found in your Frill SSO settings page

• Audience URI / SP Entity ID (SAML): Also displayed in Frill SSO settings

Copy these URLs from Frill and paste them into your IdP's application configuration.

Test the connection

After configuring both sides:

1. Open a private/incognito browser window

2. Navigate to your Frill login page

3. Click the SSO option for your provider

4. Sign in through your identity provider

5. Confirm you're redirected back to Frill successfully

Once verified, you can optionally disable password-based logins to enforce SSO for all team members.

Additional settings

Expand Additional settings on any provider setup page (Frill Single Sign-On, Okta, or Microsoft Entra ID) to configure these shared options.

• Logout redirect URL — Users are redirected here after logging out of Frill.

• Email/password login options — Choose whether people can still sign in with email and password as well as SSO:

  • No, SSO only

  • Yes, have both

  • SSO for team only — Frill shows a team login link when this option is selected

• SSO secret key — Sign Frill JWTs with this key to identify users in the Frill Script. On Okta and Microsoft Entra ID it appears under Additional settings; on Frill Single Sign-On it appears on the provider page.

• Sync user profiles — When on, Frill updates each existing user's name and avatar from the SSO token on sign-in and overwrites profile changes made in Frill. When off, Frill leaves existing names unchanged and only fills in a missing avatar when SSO provides one. New users still get their name from the SSO token when their account is created.

Next steps

For detailed configuration steps:

• See Understanding SSO options in Frill for an overview

• Follow provider-specific guides for Okta or Microsoft Entra ID

• Review developer documentation for token-based authentication